Analysis
-
max time kernel
6s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01-01-2024 02:07
General
-
Target
3b9e004e649dd60ffb22f3c7e3764b5e.exe
-
Size
340KB
-
MD5
3b9e004e649dd60ffb22f3c7e3764b5e
-
SHA1
2d15dd868ce767d6a2cbb586d151b78d64e29930
-
SHA256
9b7d317656f88d4aed0c094af7385dfb39ed2a40890521a4e0c2b438027f116c
-
SHA512
7c2728d0eefc1bad62542debe5d8399f8b4779b1e3f0b8203ccebf88161abb438ce0d196c55131a47dbda2891cc0c5c33fc5ed5e23608ee278d169f787a4e09a
-
SSDEEP
6144:6u7RLTyVyjO4Q2Mt+uTMCb+56gWIFeytHdGvdregAdF7LjtNdT:xuVy64Mt+uwCb+DFeOcuPL
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b9e004e649dd60ffb22f3c7e3764b5e.exe"C:\Users\Admin\AppData\Local\Temp\3b9e004e649dd60ffb22f3c7e3764b5e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ppt.exe"C:\Users\Admin\AppData\Local\ppt.exe" -gav C:\Users\Admin\AppData\Local\Temp\3b9e004e649dd60ffb22f3c7e3764b5e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD58094d821608c7e301b19ac3204c29559
SHA13e106a3e57bc47d573802de031bb3d234697a822
SHA2560c3216963c32a043aeaff37b50684d50f10fb78c460413eb02326fbc665e7a62
SHA51256c52149f909e25e3635f7d923745416da5b49892512a7e75846e3b92066ec39939b12d313df68f1dbc96df44e6d7213a9d01524aaf17c5f22c599ad9fea8bde
-
Filesize
224KB
MD5fd8d8811c506686d74de72faa80ae39e
SHA1c5da195365fbc3d16cea2581b239c0ca4dc8eb1c
SHA2560ff2ed9249197e9fd3b39888541627094672dd5a29aa9c469324e251580c4b3f
SHA512b43b0ba3dd2821ca904a7b8aa709f81c92669bea63a2578eafe08c611c5e928e11dc8bc7999cd950477540c0f1b0d0dde4b0f0bbe65f4a9b561de2596945d90e
-
Filesize
283KB
MD5628c8bfd28dbcd565f79355de1bf60f4
SHA18ea2a7a99b1641a1738a80efbd845f06b34543f0
SHA2561acb6039efcd8604607e3678f675eac8a63423b807a8ffe19e6b75f298b09614
SHA512a2765ea9a8696ba12d8bab09ef7f3fa3c2d29b92136582898a707b2c13d96be4510ef791b5fb5c5d359d0f69ece2a143d1967a82d10913bdcab04e155b73ed53
-
Filesize
201KB
MD5518ea48b1ad5c16ea35a2c3dad135efc
SHA188bb1cc7a26186f4db3a157a5b5f5a3492dad68e
SHA2569e32fa646feb30f015b1dc995ea039416e2859447b82ac05e0f82f09799a40ed
SHA5125038682201ee112052a113617ceb69c48e64ba1893a26d8a9bb8f8ba4aad3ea143bc53b32affb92b3026401f620ee27fa1780351850b30cd818dcc259c294cea
-
Filesize
2.0MB
-
Filesize
120KB
-
Filesize
2.0MB
-
Filesize
2.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB